All face anti-spoofing datasets above are stored in video format originally. We randomly select three frames from each video clip and use the state-of-the-art face detector RetinaFace [1]} to crop the face for training. We set the fixed patch crop size as 160, and set the hyperparameter \(s = 30.0, m_l = 0.4, m_s = 0.1\)  in all protocols. We use ResNet18 [2]} as the patch feature encoder, and we did not see much performance difference while using an encoder with larger capacity (as shown in the supplementary materials). Models are trained with SGD optimizer and the initial learning rate is 0.002. We train models with maximum 200 epochs while the learning rate halves every 90 epochs. During testing, we uniformly crop the fixed-size patches from the face input image: the minimum x and y coordinates are \(size / 2.0\) , and the maximum x and y coordinates are \(width - (size / 2.0)\)  and \(height - (size / 2.0)\) , respectively. In all of the experiments during testing, we uniformly sample 3 patch anchors on each side, which results in \(P=9\)  patches for score averaging.
